creating-api-gateway-stage
aws/agent-toolkit-for-aws
Create fully configured API Gateway stages with logging, tracing, throttling, and security controls.
What is creating-api-gateway-stage?
Creates API Gateway stages with CloudWatch logging, X-Ray tracing, throttling, WAF integration, and IAM roles following AWS best practices. Use when deploying REST APIs to different environments like dev, test, or production.
- Configure CloudWatch logging for API Gateway stages
- Enable X-Ray tracing for request tracking
- Set up method-level throttling and rate limiting
- Integrate AWS WAF web ACLs for security
- Configure IAM roles and authorization options
- Apply environment-specific stage settings
How to install creating-api-gateway-stage
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill creating-api-gateway-stage- Existing REST API in API Gateway
- Deployment created for the API
- IAM permissions to create stages and modify logging roles
- CloudWatch log group (optional but recommended)
- WAF web ACL ARN if using WAF integration
How to use creating-api-gateway-stage
- 1.Identify your REST API ID and deployment ID
- 2.Define stage name and environment type (dev, test, production)
- 3.Configure CloudWatch logging by specifying log group and IAM role
- 4.Enable X-Ray tracing if needed for request tracing
- 5.Set throttling limits at stage and method levels
- 6.Associate a WAF web ACL if implementing web application firewall
- 7.Configure authorization and caching settings as needed
- 8.Create the stage and verify logging and tracing are active
Use cases
- Deploy a REST API to a production stage with full monitoring and security
- Set up separate dev, test, and staging environments with different throttling policies
- Enable X-Ray tracing to debug API performance issues
- Integrate WAF rules to protect an API from common web attacks
- Configure CloudWatch logging to audit API access and errors
- AWS API developers
- DevOps engineers managing API deployments
- Solutions architects designing multi-environment APIs
- Security engineers implementing API protection
creating-api-gateway-stage FAQ
You need IAM permissions for apigateway:CreateStage, logs:CreateLogDeliveryService (for CloudWatch), xray:PutTraceSegments (for X-Ray), and wafv2:AssociateWebACL (for WAF integration).
Verify the CloudWatch role has correct permissions, the log group exists, and logging is enabled at both the stage and method levels. Check the full procedure for detailed troubleshooting steps.
Yes, throttling can be configured at both the stage level (applies to all methods) and at individual method levels for fine-grained control.
Stage-level settings apply to the entire stage, while method-level settings override stage settings for specific API methods, allowing environment-specific customization.
WAF integration is optional but recommended for production stages. It provides protection against common web attacks and can be added or removed independently of stage creation.
Full instructions (SKILL.md)
Source of truth, from aws/agent-toolkit-for-aws.
name: creating-api-gateway-stage description: Creates an API Gateway stage with CloudWatch logging, X-Ray tracing, throttling, WAF integration, and IAM roles following AWS best practices. Use when deploying a REST API to different environments such as dev, test, or production. version: 1
Creating an API Gateway Stage
Overview
Domain expertise for creating and configuring API Gateway stages with comprehensive logging, monitoring, security, and throttling controls. Covers CloudWatch logging setup, X-Ray tracing, WAF web ACL association, method-level configuration, and authorization options.
Create an API Gateway stage
To create a fully configured API Gateway stage with logging, throttling, WAF, and authorization, follow the procedure exactly. See API Gateway stage creation procedure.
Troubleshooting
CloudWatch logs not appearing
Verify the CloudWatch role permissions, log group existence, and that logging is enabled at both stage and method levels. See the full procedure for details.
Stage creation fails
Check REST API ID, deployment ID, IAM permissions, and stage naming conventions.
WAF blocking legitimate requests
Review WAF logs, adjust rules or add exceptions, and consider count mode for testing.
Related skills
More from aws/agent-toolkit-for-aws and the wider catalog.
creating-data-lake-table
Create managed Iceberg tables on Amazon S3 with automatic compaction and snapshot management.
creating-ec2-image-builder-pipeline
Creates a complete EC2 Image Builder pipeline that builds a custom AMI with pre-installed software, distributes it to target regions, executes the pipeline, and creates a launch template. Use when setting up automated AMI creation with IAM roles, build components, image recipes, and infrastructure configuration.
creating-production-vpc-multi-az
Creates a production-ready VPC with public and private subnets across multiple Availability Zones, including internet gateway, NAT gateways, route tables, and security groups following AWS Well-Architected principles. Use when deploying multi-AZ VPC infrastructure with automatic CIDR planning and DNS resolution.
creating-secrets-using-best-practices
Create and manage AWS Secrets Manager secrets with production-grade security controls and best practices.
debugging-lambda-timeouts
Systematically debug AWS Lambda timeout failures by analyzing configuration, logs, metrics, and dependencies.
enabling-lambda-vpc-internet-access
Enables internet access for AWS Lambda functions deployed in VPC subnets by creating NAT Gateway infrastructure, configuring public/private subnet routing, and updating security groups. Use when a VPC-attached Lambda function cannot reach the internet.